CVE-2026-111171mediumCWE-918

CVE-2026-111171: medium-severity vulnerability in ethereum web3.py

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass

Published

Follow this CVE+ Monitor web3.py+ Monitor web3

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.3epss 0.3%
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
ethereum · web3.py
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ethereum web3.py

In the same product, most dangerous first.

CVE-2026-40072LOWweb3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handlingEPSS 0.2%